Machine Learning-Based Approach for Malicious Node Security and Trust Provision in 5G-Enabled VANET

Abstract

This research utilizes machine learning (ML)-based malicious node detection techniques to effectively incorporate security and trustworthiness into fifth-generation (5G) and Vehicular Ad hoc Network (VANET) systems, in contrast to traditional methods that do not employ modern techniques. VANET may be vulnerable due to vehicle mobility, network openness, and the conventional network architecture. Therefore, security and trust management using modern methodologies, such as ML approaches, is essential for 5G-enabled VANET integration, which has become a paramount concern. And due to limitations imposed by traditional security methods, which are unable to identify malicious nodes in VANET completely, processing delays are longer. Therefore, this research utilizes the VANET malicious-node dataset designed for real-time malicious node/attack detection in VANET. The proposed ML methodology uses a Random Forest (RF) and an optimized ensemble ML classifier, such as XGBoost and LightGBM, which require a security and trustworthiness solution provided by the RF Trust Extended Authentication (TEA). We simulate vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) mobility, communication behaviors, and trust metrics to assess the accuracy of malicious-vehicular-node features for the identification and detection of attacks, including False Injection, Sybil, blackhole, and Denial-of-Service (DoS). The proposed ML methodology also identifies these attack patterns, providing a realistic dataset for Intelligent Transportation System (ITS) research. In contrast, traditional VANET methods do not. We compared the performance of the proposed ML method with other literature-standard ML and RF methods using metrics such as accuracy, confusion matrices, and precision, Recall, and F1-score to measure effectiveness. In our proposed machine learning (ML) method, we achieve 99% accuracy in classifying MVN and predicting both attack, including False Injection, Sybil, blackhole, and Denial-of-Service (DoS), and benign classes, with precision, recall, and F1-score of 100% each, and establish a trustworthiness score of 100%, Whilst the standard models, such as other VANET methods achieved an accuracy of only 95%, with precision, recall, and F1-score of 98%, without a confusion matrix to confirm the model’s performance.

1. Introduction

VANET is an emerging service of 5G networks that utilizes Intelligent Transportation System (ITS) technology to address traditional transportation issues [1]. VANET includes ad hoc sensor nodes that can become malicious due to their open deployment, mobility, and traditional network architecture, leading to vulnerabilities and security concerns regarding trustworthiness. In a typical ITS, the vehicular sensor node uses V2I (Vehicle-to-Infrastructure) communication to connect to the infrastructure. V2V (Vehicle-to-vehicle) communication uses user equipment to send sensor information and to communicate with neighboring nodes to relay it promptly [2]. Consequently, security issues are a paramount concern in VANET. It raises trust concerns, limits energy efficiency, causes congestion and delays, and can be catastrophic, leading to road accidents.

Traditional security methods, which incorporate 5G and VANET approaches [3] and [4,5,6], were used to assess malicious nodes and to detect attack patterns, ensuring only energy efficiency, minimum delay, and maximum throughput for trust in VANET. To elaborate further, the research [3] proposes a secure and trustworthy 5G-enabled Internet of Things (IoT) VANET. The proposed research incorporates a software-defined network architecture into 5G VANETs to enable global information gathering and network control, strengthening Intelligent Transportation System (ITS) requirements. The research highlighted the use of real-time IoT services for monitoring ITS, enabling an innovative, secure VANET system. However, the research methodology did not specify the infrastructure types, namely V2V and V2I.

The VANET research method [4] discusses modern vehicles that connect to an external infrastructure and vehicle-to-Everything (V2X). The research discusses the real risk that today’s vehicles face of cyberattacks targeting vehicular communications. The paper proposes a three-layer framework for sensing, communication, and control, to help better understand automotive security. The sensing layer consists of vehicle dynamics and environmental sensing; however, the method is vulnerable to eavesdropping and other attacks.

The research method in [5] discusses the 5G mobile communication system, including high data rate and ultra-low device latency. The method uses massive device connections and promotes VANET development. The proposed methodology discusses new challenges, including security, privacy, and efficiency. The proposed methodology uses a hybrid device-to-device message authentication mechanism for 5G-enabled VANET. The method is also a group-signature-based mutual-authentication algorithm for V2V and V2I communication. However, there was no trust provision in the methodology discussed.

The proposed research method in [6] discusses opportunities and challenges posed by 5G-enabled networks. The research also provides safer, more efficient means for drivers to stay safe on the road. The research also creates significant security and privacy vulnerability concerns. The proposed research method utilizes a holistic approach and integrates entity authentication with privacy preservation in 5G-enabled vehicular fog computing. The paper used a novel feature-obfuscation technique that leverages vehicle request messages at early stages. In addition, the methodology employs an advanced cryptographic method that makes potential attacks more challenging. However, the paper does not leverage modern attack-detection methodologies.

Thus, given the challenges identified in the literature, these traditional VANET methods were unable to identify malicious nodes or vulnerabilities. Therefore, trust and security issues remain uninvestigated using modern methodologies that leverage ML and 5G-enabled datasets to investigate security concerns and evaluate model performance. Even though these traditional VANET methods incorporate 5G networks, they cannot achieve maximum energy efficiency, higher throughput, and minimum information-processing delay. These goals can be fully investigated using modern ML techniques to identify malicious node-feature attack patterns and assess trustworthiness, ensuring integrity in ITS. Trust and security concerns remain unresolved in traditional 5G-enabled VANETs and warrant investigation in these models.

Moving forward, we investigate security and trust concerns in the 5G network using the VANET method [3], which employs an architecture that meets only 5G security standards, without leveraging modern ML methods for security and trustworthy provisioning. Traditional 5G-enabled VANET security methods focus only on the description of security parameters such as authentication, confidentiality, availability, non-repudiation, and integrity. They refer to these parameters as VANET privacy and security protocols. Therefore, it is evident that the traditional VANET [3] and other literature methods demonstrate limitations in modern ML trustworthiness for security provision in 5G-enabled VANET methodologies [7].

Moreover, the trustworthiness of driver information used in traditional security models, and the communication of information through their proposed frameworks to other drivers on the road using ITS, must ensure security, trust, and privacy so that malicious nodes or adversaries cannot compromise efficient information delivery in VANET.

VANET uses sophisticated services and applications that incur fundamental roles and services such as the following:

• Security;
• Efficient performance.

These services and applications require advanced security, including the delivery of trustworthy, private information in VANETs. However, the latency and bandwidth of some machine learning applications pose challenges for their infrastructure, requiring high bandwidth and low latency [8]. Thus, it is evident that improved technologies, such as 5G-enabled VANETs, when used within traditional VANET methodologies, require urgent attention for evaluating security and privacy in ITS.

Accordingly, a transformed 5G-enabled VANET deployment not only improves internet broadband services/applications but also enables new services and applications in VANET use cases. 5G networks transmit data at up to 10Gbps, and they also provide ultra-low latency of 0.002 s (seconds) or less. In addition, 5G-enabled VANETs enable higher VANET mobility and provide 1000× bandwidth per unit area [9].

To investigate a new 5G-enabled VANET that leverages modern techniques, such as ML for security, trust, and privacy, we present key features of such a system in Figure 1 to motivate its development as an urgent requirement.

Figure 1. 5G-enabled VANET enhanced features proposed.

• Motivation:

The features of the 5G-enabled VANET in Figure 1 as applied in the ML case are explained below:

• Ultra-Reliable Low-Latency Communication: The 5G network delivers sub-1 ms latency and reliability of more than 90%, which is essential for safety-critical applications such as cooperative driving, collision avoidance, and autonomous emergency braking.
• Enhance Mobility Broadband (eMBB): eMBB in 5G-enabled VANET enables high-speed data rates that are greater than 10 Gbps for high-definition (HD) video streaming, HD map updates, and passenger infotainment systems.
• Massive Machine Communication Type (mMCT): mMCT in 5G-enabled VANET supports high connection density, with the capability to connect to one million IoT sensors/devices per square kilometers and enable massive sensor networks for smart city integration.
• AI/ML-Driven Security and Routing: 5G-enabled VANET employs ML (a typical example is Random Forest (RF)) for AI-driven ML anomaly detection and predictive analysis, which our proposed research concentrates on investigating, preventing threats such as anonymity and trustworthiness security concerns in VANET. The AI/ML model uses energy efficiency as depicted in Figure 1, which influences link stability and residual energy efficiency.
• Vehicular Cloud and Edge Computing: 5G-enabled VANET can offload computing tasks to nearby connected vehicles or its cloud servers, which increases efficiency and scalability.
• Enhanced safety and efficiency: 5G-enabled VANET and CPS investigation indicate it improves ITS traffic flow and enable collision warning scheme in high speed scenarios.
• Advanced V2X connectivity: 5G-enabled VANET facilitates enhanced V2V (Vehicle to Vehicle), V2I (Vehicle-to-Infrastructure), VP (Vehicle to Pedestrian), and V2C (Vehicle-to-Cloud) communication frameworks for sensitizing better communication driver environment awareness, applicable to this research, which traditional methods, including [3] and others literature standard method do not utilize [10].

Moreover, 5G-enabled VANET should provide end-to-end security for all vehicles through V2I and V2V connections to the core network, ensuring vehicle and terminal security. However, the 5G-enabled network faces the challenges outlined below [10] Only the traditional security method of investigation of 5G-enabled VANET has been used thus far. There is no known modern investigation of ML-enabled 5G VANET trustworthiness in ITS research.

• Occurrence of error tolerance.
• A larger network size can lead to congestion and a delay in timely driver vehicle information delivery.

Vehicular node deployment in VANETs that receive data requires trustworthiness provision from the sender. Thus, the trade-off between the trust provision and vehicular node data transmission anonymity is essential for establishing vehicular node data transmission anonymity.

In this research, we utilize modern ML technologies to develop a dataset of malicious node intent. The ML modern technology ensures trustworthiness, security, and privacy for ITS in the 5G-enabled VANET infrastructure. This includes investigating the VANET method [3] and other comparable literature-standard methods, which utilize Vehicle-to-Infrastructure (V2I) and Vehicle-to-Vehicle (V2V) communication approaches.

The 5G and the VANET malicious-node dataset are designed for real-time detection of malicious nodes and attack patterns in VANETs, ensuring trustworthiness provision in Intelligent Transportation Systems (ITS). We utilize features of malicious vehicular nodes (MVN), including mobility data, communication behavior, trust metrics, malicious node activity indicators, and the Target variable (is_malicious), a binary label (0 = benign, 1 = malicious) indicating whether a node is malicious. Comparatively, these features were unavailable in the traditional 5G-enabled VANET-based attack-detection method [3] and in other comparable literature methods.

This research’s significant contributions include the following:

• Investigation, development, and implementation of security and trust in 5G-enabled VANET using ML and authentication security methodology that resolves 5G-enabled VANET challenges. The proposed ML method leverages 5G-enabled VANET safety data transfer and a framework flow model to provide trustworthiness in an intelligent transportation system (ITS).
• Developing and designing a modern ML method that includes Random Forest (RF), XGBoost, and LightGBM machine learning models and classifiers for accurate feature detection of 5G-enabled VANET dataset malicious vehicular nodes (MVN) to ensure well identification and elimination of MVN for trustworthiness provision in 5G-enabled VANET.
• Development and implementation of trust relationship establishment in ML model for training and testing using the 5G-enabled VANET communication infrastructure models.
• Evaluating the performance metrics of the proposed Random Forest (RF), XGBoost, and LightGBM machine learning models and classifiers based on the detection of MVN in 5G-enabled VANET using metrics including accuracy, precision, F1-Score, Recall, and Confusion Matrix for effective identification of malicious nodes for energy efficiency and efficient or less process delay time.

The remainder of the paper is organized as follows: Chapter 2 presents a literature review of methodologies for 5G-enabled VANET. Chapter 3 presents the methodology, which involves dataset collection, development of the proposed ML methods, development of the proposed framework, and design and implementation of the network system framework model. Chapter 4 presents the experimentation and simulation results, and Chapter 5 concludes the proposed research.

2. Literature Review

Several studies reference the 5th generation (5G) network, VANET communications technology, and ITS, focusing on security and trust. These studies have been published in the VANET literature. We review 5G network methods in the literature relevant to this proposed research, based on our literature survey. The literature analyzes two 5G networks and VANET methods, including traditional-based 5G-enabled VANET and ML-based 5G-enabled VANET, as discussed below.

A

Traditional-based 5G-enabled VANET

The VANET method [6] discusses the rapid development of VANET technology and the opportunities for 5G networks, which have posed challenges for VANET fog computing. These advances have resulted in enormous security and privacy concerns. Therefore, the researchers proposed a holistic solution that includes entity authentication and privacy in 5G-enabled VANET fog computing. The authors used novel feature-obstruction technologies in which vehicles request messages and use advanced cryptographic methods. However, the methodology relies solely on traditional security approaches.

The authors’ VANET method [7] described 5G-enabled VANET as a new wireless communication technology that benefits society. However, the authors discuss how security threats compromise communications, making vehicles in VANET vulnerable due to the open nature of these networks, thereby raising potential security and privacy concerns. The authors’ research method focused on addressing communication overhead and Sybil-attack-related concerns. Therefore, the authors proposed a novel, fog-computing-based Sybil-attack-resistant approach using FC-LSR in 5G-enabled VANETs. The proposed method employs a Merkle Patricia Trie and a Merkle Hash Tree to store the current car status value and protect the data’s anonymity. However, the method does not use any modern method, including ML.

The researchers’ VANET method [11] proposes 5G-enabled VANET communication, Vehicles-to-Everything (V2X), which has emerged as a promising technology solution for addressing security and privacy concerns for drivers and autonomous vehicles. The proposed method aims to provide overall security and ensure scalability in vehicular networks. The author’s research method uses a partition network and an edge-assisted roadside unit to construct a network graph via an arithmetic optimization method. The proposed research method uses blockchain and decentralized authentication to address scalability concerns and reduce computational complexity. However, the proposed method relies solely on traditional methodology.

B

Machine learning-based 5G-enabled VANET

Using ML, 5G-enabled VANET knowledge gaps and constraints warrant discussion. We build on VANET knowledge and emphasize malicious node detection (MVN), leveraging machine learning and deep learning (DL) to address a gap in the literature.

Therefore, the VANET research method [12] identifies security issues in VANETs as a major concern. The proposed VANET research method aims to curb DoS and DDoS attacks, which are considered major security threats to VANET. The main aim of DoS and DDoS attacks is to destroy system traffic and is a major threat to cybersecurity systems. The attacks also aim to degrade VANET operations by flooding the network with excessive packets. Therefore, the authors propose an ML framework that obtains data from the application layer for threat detection. The authors used the proposed frameworks, comprising Random projection and Random matrix factorization, to obtain network traffic for analysis. However, the proposed framework fails to provide trust in the VANET. In addition, there was no 5 G-enabled VANET solution in the proposed methodology.

The authors proposed the VANET method [13] and discussed the use of federated methods to train collaborative ML models. The proposed methodology emphasized vehicular networks and focused solely on the Internet of Vehicles (IoV), enabling cooperative ML via federated learning. Therefore, the author’s main aim was to address concerns about federated learning for detecting attacks in a vehicular network. However, no clear security and trust mechanism is in place for the proposed methodology. In addition, the proposed research method does not clearly indicate any 5G-enabled VANET.

The research method in [14] investigates ML methodologies for 5G-enabled networks and employs adaptive spectrum management, quality-of-service (QoS) management, network optimization, and predictive maintenance. The researchers leverage ML algorithms and 5G networks to forecast user behavior, allocate resources, and dynamically adjust conditions, whilst enhancing performance. The researchers also discuss ML-driven methods that improve cybersecurity but did not actually include the design of any security methods for 5G networks. In addition, there was no trust mechanism designed for the framework.

Subsequently, we summarize the literature survey of both traditional and modern 5G-enabled VANET methods in Table 1 below.

Table 1. Summary of literature: traditional and modern ML 5 G-enabled VANET method.

VANET Method	VANET Type	Security	ML Model	Trust Provision
[6]	Traditional	Authentication And Privacy	Not applicable (NA)	NA
[7]	Traditional	Merkle Hash	Not applicable	NA
[11]	Traditional	Blockchain Authentication	Not applicable	NA
[12]	Modern ML/AI	Unknown	Only RF	NA
[13]	Modern ML/AI	Unknown	Only RF	NA
[14]	Modern ML/AI	Unknown	NA	NA
Proposed Method	Modern ML/AI	Authentication Privacy	RF, XGBoost, and LightGBM	Applicable

In reference to Table 1 above, summarizing the literature based on traditional and modern ML 5G-enabled methods is significant. As indicated in Table 1, the ML method that investigates trustworthiness in 5G-enabled VANETs, and employs authentication and trust for privacy, using RF, XGBoost, and LightGBM for VMN node feature classification, in the VANET dataset, is an urgent requirement that must be addressed immediately, as outlined in our proposed research methodology.

3. Methodology

3.1. Dataset Collection and Preparation

We prepare a machine learning dataset as indicated in Figure 2 and Figure 3. Subsequently, we identify critical features for MVN detection by training on data from the proposed ML system frameworks. Figure 2 shows the 5G-enabled framework used in our proposed methodology for safe data transfer and for identifying malicious vehicular nodes (MVN) using the proposed ML approach. The framework of data transfer begins with the following steps: In steps 1 through 4, vehicles that require communication trust achieve that through the RSU, following which the RSU connects with the Internet/Cloud server, which subsequently leads to the development of an ML algorithm that is developed to identify all legitimate vehicle users or benign users form part of the communication framework. Figure 3 depicts the actual ML framework flow diagram pipeline. It begins with a 5G-enabled VANET dataset, which is then preprocessed by the MVN feature extraction. This leads to the use of three developed Random Forest (RF) models: RFP (Random Forest projection), TEA (trust extended authentication), and RMF (random matrix factorization). These three processes will subsequently be explained in detail, along with how they are used in our proposed ML methodology. We initially split the dataset into a training set (80%) and a test set (20%). Subsequently, we will explain our proposed ML methods, RF, and ensemble methods comprising the XGBoost and LightGBM models. Thus, we extracted features for MVN detection using the framework method, including the Random Forest (RF) classifier and the trust relation (TR) authenticator, Implemented through our proposed TEA (trust extended authentication) algorithm, as shown in Figure 2 and Figure 3 below. Figure 3 provides further details on the proposed TEA algorithm development, based on trust relationship establishment in the ML framework models and the data preprocessing described below.

Figure 2. 5G-enabled VANET framework. Safe data transfer and VMN identification.

Figure 3. Machine learning (ML) framework flow diagram.

3.2. Machine Learning Framework: Data Preparation and Preprocessing Based on Trust

To ensure trustworthiness in our proposed system framework (Figure 2), we develop, design, and implement a security and trustworthiness ML method that leverages the proposed RF and ensemble ML models, including XGBoost and LightGBM. Thus, we optimized our proposed ML method based on the VANET method [12]. The VANET method [12] has limitations in actual 5G and VANET deployments. However, the method [12] utilizes vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) communication, as shown in Figure 2, which is unique and desired in our framework. Subsequently, we applied the ML method [12] with optimized solutions using RF, XGBoost, and LightGBM classifiers to evaluate the 5G-enabled VANET dataset.

In addition, we optimized the VANET method [3] used in our proposed system framework, leveraging the V2I and V2V infrastructure required for 5G-enabled VANETs. However, based on the literature, the VANET method [3] has limitations due to security concerns. It requires classification models in our proposed ML method, such as Random Forest (RF), XGBoost, and LightGBM [3]. Therefore, we investigate security and trustworthiness for a privacy solution in a 5G-enabled VANET dataset using our proposed ML method. Our proposed ML leverages our developed Trust Extension Authentication (TEA) and optimized ML ensemble models, XGBoost, and LightGBM. Thus, deploying the TEA algorithm in our proposed ML method is a priority that enhances the identification and detection accuracy of MVNs in 5G-enabled VANET communication. Consequently, our proposed ML system framework utilizes secure trustworthiness and privacy capabilities for the 5G-enabled VANET infrastructure, as shown in Figure 4 and Figure 5.

Figure 4. Trust relationship (TR) establishment to 5G-enabled VANET.

Figure 5. Trust relationship (TR) flow Chart for 5G-enabled VANET.

Figure 4 depicts trust relationship (TR) establishment in our proposed ML method for a 5G-enabled VANET, developed based on the proposed TEA algorithm.

All vehicles are designated with an OBUi (onboard processing unit). There are two types of cars in the design: red and green cars. The green cars designate vehicles with trust (VWT), whereas the red cars designate vehicles without trust (VWOT). Thus, VWT establishes a trust extended authentication (TEA) with VWOT. There are situations in which two VWOT establish TEA amongst themselves. This subsequently leads to the design of Figure 5, which presents the TR flowchart for each 5G-enabled VANET implementation for all vehicles in our proposed ML method below.

As shown in Figure 5, the process of establishing TR implementation for 5G-enabled VANET is demonstrated.

LE (Law Execution) establishes communication with all OBUi. If communication fails, authentication is reestablished with LE. When all OBUis are successfully authenticated with LE, all VWTs become successfully authenticated. However, if VWT is not authenticated, it is tried again. After that, VWT reestablishes communication with all other vehicles’ OBU in the network designated as OBUj. After successful authentication of all OBUj, all vehicles achieve trust in the network. We now examine how security and trust are implemented in our proposed ML method, based on the MVN attack.

3.3. Security and Trust in 5G-Enabled VANET Malicious Vehicular Nodes Attack Model

To implement security based on attacks on MVN and provide trust for the proposed 5G-enabled VANET dataset, we utilized our proposed ML method and secure data transfer framework in Figure 2, along with the previously discussed VANET framework in Figure 3. We first discuss how 2G/3G/4G networks were initially the next generation of communication technologies and were used in VANETs; however, they experienced attacks in their frameworks. Therefore, as 5G-enabled VANET vehicles originate from them, they are more susceptible to adversarial attacks. Adversarial attacks could create MVN, leading to illegal duplication and the broadcast of faulty information to drivers. Consequently, 5G-enabled VANETs that provide trustworthiness become an urgent concern [15].

Moreover, given that MVN identification limitations remain unresolved in the literature and that security and trust concerns persist with traditional 5G-enabled VANET methods, we consider it urgent to use our proposed Trust-Extended Authentication (TEA) machine learning Algorithm 1 below to investigate these concerns. Based on our proposed RF model, we deploy TEA, investigate, and ensure the trustworthiness of all vehicle locations in the 5G-enabled VANET.

Thus, we implement the proposed TEA algorithm, which comprises seven phases as follows.

Algorithm 1. TEA Algorithm Based on RF

Setup Phase Login Phase Overall Authentication Phase Password Change Trust-Extended Authentication Phase Keys distribution Updating Phase Keys Revocation Phase

In Algorithm 1, Steps 1–4 and 6–7 are identical to those in the existing literature [16,17]. Our contribution depends on Steps 5 and 6 (Trust-Extended Authentication).

Now, let us consider a different scenario with three vehicles in the 5G-enabled VANET, as shown in Figure 4 above. The cars are divided into three subsets: Law Executor (LE), Vehicle with Trust (VWT), and Vehicle Without Trust (VWOT). A public authority bus or a police van can be LE and can act as a mobile Authentication Server (AS), also known as a VANET communication Server.

We use two other OBU (Onboard Processor Unit)-incorporated vehicles, denoted as VWOT. The steps below describe how the cars in the network are authenticated and upgraded from VWOT to VWT to establish trust and privacy for network communication. Thus, we deploy the authentication process in the proposed ML method pipeline shown previously in Figure 3.

In addition, we describe the trust relationship implementation flowchart for the 5G-enabled VANET in our proposed ML method framework, as shown in Figure 5 above.

• Initially, the first VWOT, ${OBU}_i$, upgrades to a vehicle with trust (VWT) once authenticated by the nearest LE.
• Subsequently, ${OBU}_i$ is authenticated and obtains the parameters, acting as an interim LE, which further authenticates other vehicles without trust (VWOT), ${OBU}_{j.}$

3.4. Explanation of Implementation and Deployment of RFP and RMF for Detection of MVN

To improve the detection of MVN in the proposed ML method, we employ the proposed machine learning models, RF’s RFP and RMF, together with our proposed ensemble of LightGBM and XGBoost classifiers. We explain and implement in detail below.

• Random Forest Projection (RFP): The dimensions of the dataset utilized in the machine learning (ML) method have a significant impact on the RF performance and computational efficiency [18]. Therefore, we adopt the Random Projection (RP) used in the VANET method [12] as Random Forest Projection (RFP) in our proposed ML method. We convert high-dimensional data into a lower-dimensional space.
• The proposed RFP maintains the dataset’s key features for the identification and detection of MVN, and subsequently becomes VWT. We anticipate that the practical RFP techniques used in our proposed ML method improve computational performance and enable effective handling of all MVN features in our 5G-enabled VANET dataset.

Therefore, the expression used for our proposed RFP in our RF model is deduced in the equation below:

$$U=M+S$$

(1)

We increase computational efficiency in our proposed ML method by using a high-dimensional matrix (M) and linearly projecting it onto a lower-dimensional space (S) to obtain a reduced MVN feature matrix $U$.

• Random Matrix Factorization (RMF): We adopt and use RMF from the RF model in the VANET method [12] to improve the computational efficiency, scalability, and feature extraction capabilities, for the efficiency of the machine learning models, and this handles complicated MVN in the 5G-enabled VANET datasets.

$$X={(Y}^T\left(Y{Y}^T\right){)}^{-1}B$$

(2)

$$Y={(X}^T\left(X{X}^T\right){)}^{-1}B$$

(3)

We optimize $X$ using Equation (2) and maintain $Y$ as constant.

Meanwhile, in Equation (3), $X$ stays fixed, and we optimize $Y$.

Here, X represents the feature matrix input data, and Y represents the target vector, i.e., labels or output.

One main objective of this research is to employ the RFP and RMF techniques in our proposed ML method, which utilizes Random Forest (RF) and ensemble XGBoost and LightGBM classifiers, to optimize the identification and detection of effective MVN. We analyze the dataset by blending RFP and RMF in our proposed ML framework, as shown in Figure 2 and Figure 3, to reduce overfitting. However, we first develop and optimize our proposed RF model, and then implement it alongside our ensemble ML models, XGBoost and LightGBM. The optimized solution is grounded in security and trust within the 5G-enabled VANET MVN attack model—this helps assess the performance of our ML method frameworks in Figure 2 and Figure 3.

3.5. Ensemble Learning Classifier Implementation

XGBoost and LightGBM are gradient-boosting methods used in our proposed ML method as an optimized ensemble learning classification approach. Thus, XGBoost and Light complement our proposed RF model. In our proposed ML method, we use XGBoost and LightGBM to handle large, complex datasets. We also use them for prediction whilst utilizing the 5G-enabled VANET dataset. XGBoost is popular for its efficiency and regularization capabilities, which help control overfitting, using techniques including tree pruning as defined in Equation (4) below:

$$\mathrm{Optimal} \mathrm{Depth} ={\displaystyle \genfrac{}{}{0pt}{}{\arg min}{depth}}{\sum }_{i=1}^{N}L(y_i,{\widehat{y}}_i)+\lambda \parallel w{\parallel }^2$$

(4)

Here, $L$ represents the loss function, $y_i$ and ${\widehat{y}}_i$ are the actual predicted values, and $\lambda$ is the regularization parameter.

In contrast, the LightGBM model utilizes a histogram-based technique to speed up training. In addition, LightGBM efficiently handles categorical data variables, making it well-suited for high-dimensional data. These two models, together, capture non-linear interactions and complex patterns, which are critical for accurate standard predictions. We established baselines with the XGBoost and LightGBM models and combined them with the proposed Random Forest (RF) model in our ML method.

Thus, we adopt an ensemble learning classifier [19] comprising XGBOOST [20] and LightGBM [21] to enhance predictive accuracy and robustness in our proposed ML method. By using this combined-output model strategy, we leverage complementary strengths and mitigate overfitting by integrating predictions from the two models.

Therefore, we define the ensemble model in our proposed ML method as Equation (5):

$${\widehat{y}}_{ensemble}\left\{\begin{array}{c}{\widehat{y}}_{XGBoost, } if{\widehat{y}}_{XGBoost, }\le pre{d}_{outlie{r}_{threshold}}\\ {\widehat{y}}_{LightGBM, } otherwise \end{array}\right.$$

(5)

Now, pred_outlier_threshold is determined as the 90th percentile of all the predictions made by the XGBoost model, i.e.,

$$\mathrm{Pred}\_\mathrm{outlier}\_\mathrm{threshold}=\mathrm{percentile}\left({\widehat{y}}_{XGBoost, } 90\right)$$

(6)

We choose this threshold (90%) to identify high-value predictions (i.e., potential outliers) deemed less reliable when historical data is used. In addition, a 90% threshold is used because the dataset may be noisy, and we expect many outliers. And the chosen threshold of 90% balances integrity, thereby keeping relevant data, and ensures the model’s robustness. Threshold 90% also helps us remove extreme noise in the features predicted for the MVN detection, which is considered a high priority. We substitute the XGBoost model’s prediction with the LightGBM model’s prediction in a similar manner. Based upon this, we improve robustness to outliers and enhance overall prediction accuracy and stability for accurate identification and detection of VMN in the 5G-enabled VANET dataset. The literature supports the effectiveness of such a threshold-based ensemble technique using an RF decision tree and voting ensemble regression [22].

Moreover, XGBoost comprises our proposed ML method, multiple RF forest trees, and we generate each tree using gradient descent and optimization to minimize the objective function. Consequently, we use XGBoost to effectively extract attributes across different dimensions of the 5G-enabled VANET dataset to predict malicious nodes [23]. The XGBoost model’s basic learners utilize two classifiers (gbtree) and a linear classifier (gblinear).

In addition, the XGBoost model simultaneously executes a second-order Taylor expansion on the objective function. XGBoost overcomes overfitting by using the complexity function of the trees as the constant terms of the objective loss function based on the XGBoost model proposed in our ML method, as follows:

$$Object\left(t\right)= {\sum }_{i=1}^{n}l(y_i, {\widehat{y}}_i^t)+ \mathsf{\Omega }\left(f_t\right)+C$$

(7)

$${\widehat{y}}_i^t={\widehat{y}}_i^{t-1}+f_t\left(x_i\right)$$

(8)

$$\mathsf{\Omega }\left(f_t\right)={\mathsf{{\rm Y}}T}_t+{\displaystyle \frac{1}{2}}\lambda \parallel \omega {\parallel }^2$$

(9)

Here, $C$ is constant, $x_i$ is the input vector, $T_i$ represent the number of leaves in the tree $\mathsf{Y} \mathrm{a}\mathrm{n}\mathrm{d} \lambda$ are hyperparameters ${\widehat{y}}_i^t \mathrm{a}\mathrm{n}\mathrm{d} y_i$ exhibit the predicted and the fundamental values of the MVN, respectively. $l\left(.\right)$ denotes the square loss function and $f_t\left(.\right)$ is the regression tree. Nevertheless, according to Taylor’s formula, the objective function $Object\left(.\right)$ is approximately expressed as follows:

$$\begin{array}{c}Object\left(t\right)\approx {\displaystyle \sum _{i=1}^n}[l(y_i,{\widehat{y}}_i^{t-1})+g_i{f}_t\left(x_i\right)+ {\displaystyle \frac{1}{2}}{h}_i{f}_t^2(x_i)]\\ + \mathsf{\Omega }\left(f_t\right)+C \end{array}$$

(10)

where $g_{i }$ and ${\displaystyle \frac{1}{2}} h_i$ are coefficients of the first and quadratic terms in the Taylor expansion, respectively [24].

We subsequently determine the classification of our proposed ML method, which involves the RF, XGBoost, and LightGBM models below.

3.6. Classification of the Proposed ML Method

In this research, we assess the effectiveness of three machine learning methods for classification in our proposed ML models: Random Forest (RF), XGBoost, and LightGBM. These ML models in our proposed methods are used to classify malicious MVN in 5G-enabled VANET traffic into trust scores, including neighbor trust and historical trust. The models also help classify the MVN attack categories, such as false packet injection attacks, Sybil attack attempts, blackhole attack attempts, and denial-of-service (DoS) attacks.

Therefore, we use these three classifiers, RF, XGBoost, and LightGBM models, in our proposed ML method to investigate malicious node attacks. These techniques in our proposed ML method effectively differentiate MVN (i.e., VWOT) from VWT. Therefore, we must develop and implement a continuous authentication algorithm that leverages our proposed ensemble ML methods, including XGBoost and LightGBM, below.

3.7. Continuous Authentication Algorithm for the XGBoost and LightGBM

We implement the continuous authentication algorithm for both XGBoost and LightGBM registration and authentication, consisting of two Algorithms 2 and 3, as follows. We optimize the [25] VANET method, like our proposed ML method, which employs a registration process before authentication.

Algorithm 2. Algorithm for Registration XGBoost and LightGBM

During registration, train the Vehicle user OBUi to identify new vehicle users using models such as XGBoost and LightGBM. Start the registration stage. OBUi collects a certain amount of VWT or VWOT user data and performs a preprocessing operation on the 5G-enabled VANET dataset. Missing values process, data duplication and feature analysis are performed. Optimization of XGBoost and LightGBM parameters attained. 4. Classification and training of OBUi user data features using the optimized XGBoost and LightGBM to obtain the vehicle user identity in the database. 5. End

Algorithm 3. Algorithm for the Authentication of XGBoost and LightGBM

The authentication stage continuously verifies all VWT user identities and periodically during the Vehicle user’s use of the OBUi device as follows: Start the authentication stage process for both XGBoost and LightGBM mod-els. OBUi collects a certain amount of VWT user data and performs a preprocessing operation on the 5G-enabled VANET dataset. Missing values process, data duplication and feature analysis OBUi user identity verification using a trained model, performing steps 6–8 based on results. If successful authentication, the current vehicle user becomes VWT, regarded as the right user. If unsuccessful authentication, the current user is VWOT and is an unauthorized user. VWOT User can continue to access the system. Go back to step 1 for continuous authentication till it becomes a VWT user and becomes authenticated. End

The explanations of both Algorithms 2 and 3 are inherent. These algorithms ensure that the proposed ML models used in our ML method demonstrate a novel approach in our ML models configuration experiment and simulation results. This helps efficiently identify and detect all trust scores and their associated attack patterns, including False_injection_attacks, Blackhole_attacks, Sybil_attacks, and DoS_attacks. In addition, we measure network performance metrics relevant to this research investigation using a 5G-enabled VANET dataset, as discussed in detail below.

4. Dataset Description, Model Configurations, and Simulation Results

4.1. Dataset Description

We verified the proposed ML method, which uses RF, XGBoost, and LightGBM in this paper, using a standard 5G-enabled VANET in-house dataset collected as described Kaggle data repository (https://www.kaggle.com/datasets/ziya07/vanet-maliciousnode-dataset/code, 1 February 2026). The dataset depicts a VANET malicious node dataset designed for real-time malicious node detection in Vehicular Ad hoc networks (VANET). Using this dataset, we simulate vehicle mobility, communication behaviors, trust metrics assessment, and attack patterns, and provide a realistic dataset for security research in ITS. The standard dataset supports the development and evaluation of deep learning and ML models, such as RF, XGBoost, and LightGBM, which this research investigates and optimizes for high-mobility environments and 5G-enabled VANET security.

4.2. Simulation Experiment

In Table 2, we used the latest version of the Python, Jupyter version 7.5.5 distribution package and the sklearn libraries for the model simulation experimentation configuration of our proposed machine learning method simulation. Therefore, we use Random Forest, XGBoost, and LightGBM models for our simulation and experiments. In addition, we use hyperparameter tuning to achieve optimal performance. Based upon this, XGBoost was configured using a maximum tree depth of 10, a learning rate of 0.003, 2000 estimators, and subsampling parameters of 0.9 for rows and 0.8 for columns. Similarly, we configure LightGBM with a maximum depth of 15, a learning rate of 0.003, and 1200 estimators, with subsample and feature fractions of 0.85 and 0.75, respectively. These settings, used in the model configuration and the experiment, balance complexity and generalization on high-dimensional, temporal data. Based on the proposed Random Forest (RF) model, we used hyperparameter optimization techniques, including random search, to effectively fine-tune the model [25].

Table 2. Experimental simulation setup hyperparameters.

Parameter	Value
Learning rate of all models (RF, Boost, and LightGBM)	${10}^{-3}$
Sample batch size	10
Estimators XGBoost and lightGBM	2000, and 1220
Subsamples	0.85
Feature fraction	0.75
Classifiers	RF, XGBoost, and LightGBM
GPU	RTX3072
Processor	Intel Xeon W 1370
Windows Platform	11 has 16GB RAM, SSD
Language Platform	Python, Jupiter Notebook

Therefore, we trained the XGBoost, LightGBM, and the RF models in our proposed ML methods using default Scikit-learn configurations with no regularization (shown below) to simulate and analyze attacks and all network traffic behaviors in the dataset.

4.3. Analysis of Attack Behaviors Used in the 5G-Enabled VANET Dataset

• False Injection Attack (FIA):

We term this type of attack a False Injection attack (FIA) [26]. In the Intelligent Transportation System (ITS), an FIA challenges the network’s integrity by modifying the information in the packet payload and manipulating the behavior of a vehicular node to turn it into a malicious node. Through an FIA, data in the network can be easily manipulated, even when preventive measures are in place, and when an attacker successfully infiltrates the network, or when an insider becomes malicious. FIAs inject false information into the ITS, leading to network problems and an outcome that depends on the modified message. For example, emergency information dissemination is used in a 5G-enabled VANET to warn vehicle drivers of road accidents. The 5G-enabled VANET uses beacon messages to provide vehicle location information and traffic warnings during traffic congestion.

Beacon messages propagate through the network via multi-hop or broadcast transmissions. When these messages are modified or duplicated, network performance decreases, as vehicles either slow down or divert to other roads. Intrusions create security attack patterns, including Sybil, DoS, and Blackhole attacks, which warrant further investigation [27].

• Sybil Attacks:

To present the Sybil attack [28] scenario in VANET, we imagine that vehicles may appear as a single node in the network. All network nodes may have their own digital identities and communicate using messages that include the sender’s timestamp, position, speed, and acceleration. These messages can be exploited due to Sybil attacks. Sybil attacks reveal a malicious node in peer-to-peer networks. These malicious vehicular nodes use multiple identities, including false and usurped identities, and take control of the entire network, enabling them to disrupt information flow and harm genuine nodes. Sybil attacks may result in two node types: Sybil nodes and Malicious nodes. Sybil nodes represent ensemble nodes under an attacker’s control, whilst malicious nodes are the attacking nodes that control them.

• Black Hole Attack:

A black hole attack [29] in VANET is an attack in which a malicious vehicular node (MVN) drops a packet, causing it to disappear. A black hole attack works by forcing itself into the network and becoming an active, genuine node. Based on its behavior, a black hole attack can occur whenever communication between nodes is in place [30].

Black hole attacks act as malicious vehicular nodes and provide information that they are active or genuine nodes, causing all neighboring nodes to route packets in their direction, besides the black hole attack, and send fake routing, and claim that black hole nodes have routes that are optimal so that the source node will choose the delivery route via black hole nodes [31].

• Denial of Service attack (DoS):

VANET is vulnerable to several security attacks, including DoS attacks [32], due to the unique vulnerabilities of both systems. DoS attacks are among the most critical security threats in 5G-enabled VANETs, as they can disrupt the entire network [33]. VANETs are subject to many attacks, including DoS and Sybil attacks, due to dynamic topology changes and reliance on wireless communication [34]. Excessive traffic and malicious vehicular node requests in 5G-enabled VANETs must be managed and rerouted to ensure information is handled effectively and prevent DoS attacks across the network.

As a result, significant network disruptions occur, including delays in safe critical communications, for example, vehicle collision avoidance alerts, and accident notifications. These ultimately lead to VANET severe or degraded performance. Thus, the integration method introduces additional security risks and necessitates advanced defense mechanisms, such as the ML-based approach proposed in this research, to protect against malicious vehicular nodes and vulnerabilities in 5G-enabled VANETs.

4.4. Technical Behaviors Used for Simulating Attacks in the 5G-Enabled VANET

Discussion

Based on the simulation, our proposed ML methods, including RF, XGBoost, and LightGBM, use features extracted from the simulations. The features characterize each category of trust scores and attack patterns, including DoS, Sybil, False injection, and Blackhole attacks (DSFBA). In addition, the features reveal other network-significant performance metrics, as shown in Figure 6 below, which this research considers. The RF, XGBoost, and LightGBM identify all these specific trust scores categories and the DSFBA attack patterns. Thus, our proposed models detect resource and traffic anomalies using packet counts, flow duration, and inter-arrival time, received signal strengths (RSSI), and trust scores, etc. This indicates that sudden spikes in the number of packets may be sent from a single source in the 5G-enabled VANET communication framework we developed, involving VWT and VWOT.

Figure 6. Graph of RF feature versus importance.

In Figure 6, we show the Random Forest (RF) model’s feature importance. The RF importance measures which input features contribute to the predictive ability of our proposed ML method models, aiding interpretation by ranking features based on their impact on accuracy or on the reduction in node impurity (Gini importance). Therefore, our proposed RF model identifies key drivers to support feature selection, enabling the understanding of non-linear data relationships, although it can be biased towards high-cardinality features. We use the Gini importance, represented on the X-axis, to calculate the total reduction in node impurity (also known as Gini impurity or variance), achieved by a feature across all trees in the forest. A greater decrease indicates greater importance. Therefore, as seen in Figure 6, trust_score, which is more important, is identified as a highly important network parameter with an importance of 0.37. It is followed by neighbour_trust_score, with an importance of 0.27. Subsequently, it is followed by historical_trust_score 0.17 (all these three trust scores representing the highest importance). In addition, it is followed by all attack patterns, including False_packet_injection (importance 0.07), blackhole_attacks (importance 0.05), Sybil_attack_attempts (importance 0.025), and denial_of_service_attack (importance 0.015). This demonstrates the capability of our proposed ML method to prioritize trust scores, enabling it to detect all these attack patterns in our models.

In Figure 7, we assess the predictive ability of the XGBoost and LightGBM models’ feature importance. These models’ importance in predicting helps identify all trust scores and other network attack feature patterns, which our proposed methodology considers vital. Therefore, we used the F-score as the default metric in the XGBoost and LightGBM libraries for the feature importance plot. The F-score is a metric for measuring feature importance. The F-score, shown on the X-axis in Figure 7, is the total number of times a specific feature identified by our proposed models is used to split the data across all decision trees across the three models: RF, ensemble XGBoost, and LightGBM. The F-score is also known as the “weight” importance type in our proposed ML method. The interpretation is that a model with a higher F-score indicates the feature was used more frequently during model building and is therefore considered more important by our proposed models, warranting its status as a top priority. In this case, we can see in Figure 7 that trust_score has the highest F-score (63), followed by False_packet_injection (43), Sybil_attacks (33), blackhole_attack_attempts (33), denial-of-service attacks (28), and historical_trust_score (24), indicating that trust in our proposed model is the most important feature. Therefore, we consider trust_score a higher priority for our proposed model’s decision-making during feature selection, followed by all other attack feature patterns, which we have used to achieve a higher detection rate for the attacks identified as important features.

Figure 7. Graph of XGBoost + LightGBM feature versus F score.

4.5. Feature Importance Based on Mean Decrease in Malicious Nodes

In Figure 8, an additional explanation of feature importance is provided to aid further elaboration. We use the feature importance of a forest of trees to evaluate the feature importance of our proposed machine learning methods, including the Random Forest (RF), XGBoost, and LightGBM models, for classification tasks. Features such as acceleration, direction, and position, which fall within the range 0.00–0.002, were deemed less necessary, based on the interpretation of feature importance attributes. Features that include attack pattern types such as False packet injection, blackhole attack attempts, sybil attack attempts, and denial-of-service (DoS) were depicted as the next-to-last features, with values ranging from 0.05 to 0.10. However, the feature indicators for vehicle trust establishment, including historical_trust_score, neighboring_trust_score, and actual trust_score, enable the model to identify and detect malicious node features effectively. These are estimated at 0.20–0.40. This indicates high feature importance due to their reliance on the historical trust score, the average neighbor trust score, and the actual trust in the 5G-enabled VANET dataset. This further affirms that trust scores and attack pattern detections in our proposed methodology are a priority.

Figure 8. Top feature importance graph.

In Figure 9, our proposed ML models demonstrate selecting a specific column from the training data frame. The columns typically use True/False Boolean values or numerical values (0/1) to indicate whether a data entry from the 5G-enabled VANET dataset is malicious. Since we treat “is_malicious” as a binary feature, the histogram in Figure 9 visually shows the dataset’s class balance. The two bars indicate “benign” (or 0), which includes a high packet count of 3750, indicating good efficiency for information delivery in the 5G-enabled VANET, and one for “malicious (or 1), which means low counts of 1250 malicious nodes detected in the network.

Figure 9. Graph of count versus percent of Less Is_Malicious.

4.6. Feature Correlation Matrix of the Proposed ML Method for Classification of Malicious Node

Generally, a correlation matrix is used to examine correlations among independent variables (i.e., features) and between independent and dependent variables (i.e., features and target variables). We use a feature correlation matrix based on the following situation.

We identified feature–target correlations to determine which features of the 5G-enabled VANET dataset are highly correlated with the target variables, thereby highlighting the practical features that play a significant role in predicting whether a vehicular node is malicious or non-malicious. We investigated the feature correlation matrix to assess feature importance and explain which features were high, which were ignored, and which were low and used in the dataset during data preprocessing. The graph in Figure 10 clearly shows the features with their estimated values.

Figure 10. Feature correlation matrix of the Random Forest model.

We also determined the correlation among the features to drop highly correlated features, since the same features compared in the correlation matrix will have the same kind of effect on the output variable, being malicious or non-malicious. As depicted in Figure 10, we present a correlation heatmap of the feature correlation matrix, except for trust score, neighbor trust score, and historical trust score, which all have correlation scores between 0.0 and 0.2, indicating low correlation. A lower correlation score also shows the most critical scores measuring the trust in the proposed method’s classification effectiveness, followed by all attack categories, such as False_injection, Blackhole, Sybil, and DoS. While all the remaining features are highly correlated, we drop the highly correlated ones.

Distribution of Malicious Nodes and Non-Malicious Nodes

Based on Figure 11 and Figure 12, we used an RF classification model to predict the distribution of malicious and non-malicious nodes, using unique labels and simulation data. The total traffic, both malicious and non-malicious, is set to 5000 packets, comprising 3750 from non-malicious nodes and 1250 from malicious nodes, based on the distribution of malicious nodes in the simulation. Based on the packet counts from the experiment and simulation results, we plot the distribution of malicious versus non-malicious nodes in the 5G-enabled VANET dataset, as shown in Figure 11 and Figure 12. The X-axis depicts whether a node is malicious (1 = Yes, 0 = No), whereas the y-axis represents the packet counts of non-malicious and malicious nodes. Thus, these graphs further indicate that 3750 non-malicious nodes were classified in the network, whilst only 1250 malicious nodes were detected. These further attest to the proposed ML method’s ability to account for fewer malicious vehicular nodes (MVN) in the network.

Figure 11. Graph of malicious node distribution of packet counts versus is-malicious.

Figure 12. Malicious node distribution of number of observations versus is_ malicious values.

In Figure 13, we show the pie chart distribution of malicious vehicular nodes classified in the dataset used by our proposed ML method models. The model also uses the packet value_counts () method, which returns a series with the unique values of the is_malicious column as the index and their counts as the values. These index values are used as the labels. From the pie chart, the malicious nodes account for only 25.2%, whilst the benign traffic accounts for about 74.8%. This indicates a higher percentage of benign traffic and a lower packet rate of malicious traffic classified, which is the epitome of efficient message delivery in the 5G-enabled VANET communication framework, in our proposed ML method.

Figure 13. Pie chart for distribution of malicious vehicular nodes (MVN).

4.7. Binary Classification Report and the Confusion Matrix of the Proposed Machine Learning Method

The classification reports and confusion matrix (CM) of all three models, Random Forest, XGBoost, and LightGBM, in our proposed machine learning method are a summary of the models’ performance that provides key metrics for each class (0, 1) for the classification of MVN attack traffic and benign traffic. The metrics used include precision, recall, F1-score, accuracy, and support. These metrics help evaluate how well the three models predict outcomes across different feature classes in the 5G-enabled VANET dataset used in this research.

Based on the experimental and simulation results of our proposed machine learning (ML) method, we utilize the three models—Random Forest, XGBoost, and LightGBM—for the classification report and confusion matrix (CM), which are explained subsequently, below, using the following metrics used in our ML method.

We used the following standard classification report functions, which utilize the following metrics in our proposed ML method.

• Precision:

We define the precision of the proposed ML method as the ratio of all correctly predicted positive observations to the total number of predicted positive observations in the simulation run. High precision relates to a low false-positive (FP) rate—that is, it usually predicts the correct class.

$$Precission={\displaystyle \frac{TP}{TP+FP}}$$

(11)

Recall Sensitivity, True Positive Rate:

We defined the recall of the proposed ML method based on Random Forest, XGBoost, and LightGBM as the ratio of correctly predicted all-positive observations in the actual class. This indicates high recall relates to low false-negative rate—that is, it usually finds most actual class instances.

$${\displaystyle \frac{Recall}{Sensitivity}}={\displaystyle \frac{TP}{TP+FN}}$$

(12)

F1/F-Score:

We define the F1/F/F-score of the proposed ML methods (Random Forest, XGBoost, and LightGBM) as the harmonic mean of precision and recall. We use the F1-score as a valuable metric to balance precision and recall, especially when dealing with cases with uneven class distribution.

$$F1/F-Score=2\ast {\displaystyle \frac{Precission\ast Recall}{Precission+Recall}}$$

(13)

Support:

We define support for the proposed ML method as the total number of actual occurrences of the class in the specified dataset; for example, the 5G-enabled VANET dataset used in this research is the test set.

• Accuracy:

We define the accuracy of the proposed ML method as the overall correctness across all models and classes: Random Forest, XGBoost, and LightGBM.

$$Accuracy={\displaystyle \frac{TP+TN}{TP+TN+FP+FN}}$$

(14)

where in all, $TP$ is the true positives, $FN \mathrm{i}\mathrm{s} \mathrm{t}\mathrm{h}\mathrm{e} \mathrm{f}\mathrm{a}\mathrm{l}\mathrm{s}\mathrm{e}\mathrm{n}\mathrm{e}\mathrm{g}\mathrm{e}\mathrm{t}\mathrm{i}\mathrm{v}\mathrm{e}\mathrm{s},$ $TN \mathrm{i}\mathrm{s} \mathrm{t}\mathrm{h}\mathrm{e}$ true negatives, and $FN \mathrm{i}\mathrm{s} \mathrm{t}\mathrm{h}\mathrm{e}$ false negatives.

• Random Forest

In Figure 14, we present a confusion matrix (CM) of the Random Forest (RF) model’s performance on the test set, using the actual values to evaluate it. Therefore, we compare the actual class labels (rows) with the predicted class labels (columns). The model correctly predicted malicious vehicular node (MVN) attacks and benign classes. This means the RF model correctly predicted 759 non-MVN attacks (i.e., benign) and 0 false injections, Sybil, blackhole, and DoS attacks.

Figure 14. Confusion matrix of the Random Forest model.

In Table 3, we show the classification report for the RF model of our proposed ML method. In this situation, the RF has 100% precision and 100% recall for both classes, indicating it did not miss many instances of either class (MVN attacks or benign). The Random Forest’s 100% precision and recall are due to its extensive collection of decision trees, which yield predictions from consensus across many trees. In addition, RF is always recognized by its improved performance metrics compared to other decision trees and models. However, we acknowledge that some attributes specific to the 5G-enabled dataset can markedly influence the efficacy of the forest used [35].

Table 3. Random Forest classification report.

		Precision	Recall	F1-Score	Support
	0	1.00	1.00	1.00	759
	1	1.00	1.00	1.00	241
accuracy				1.00	1000
macro	avg	1.00	1.00	1.00	1000
weighted	avg	1.00	1.00	1.00	1000

• XGBoost

In Figure 15, we present a confusion matrix (CM) of the XGBoost model’s performance on the test set, using the actual values to evaluate it. Therefore, we compare the actual class labels (rows) with the predicted class labels (columns). The model correctly predicted MVN attack patterns or benign classes. This means the XGBoost model correctly predicted 748 non-MVN attack patterns with zero false injections, Sybil, blackhole, and DoS attacks.

Figure 15. Confusion matrix of XGBoost model.

In Table 4, we show the classification report for the XGBoost model of our proposed ML method. In this situation, the XGBoost achieves 99% precision and 99% recall for both the MVN attack class and benign instances, indicating it did not miss many cases of either class. The high precision and recall of 99% are achieved because XGBoost uses a gain function to optimize splitting point selection within the decision tree, as explained previously, thereby strengthening the model’s predictive accuracy and overall efficiency. In addition, XGBoost is widely validated across diverse domains and demonstrates superior performance [36]. However, we acknowledge that overfitting could be high, which we will investigate in future work.

Table 4. XGBoost classification report.

		Precision	Recall	F1-Score	Support
	0	1.00	0.99	0.99	748
	1	0.99	0.99	0.99	252
accuracy				1.00	1000
macro	avg	1.00	1.00	1.00	1000
weighted	avg	1.00	1.00	1.00	1000

• LightGBM

In Figure 16, we present a confusion matrix (CM) of the LightGBM model’s performance on the test set, using the actual values to evaluate it. Therefore, we compare the actual class labels (rows) with the predicted class labels (columns). The model correctly predicted MVN attack patterns and benign classes. This means the LightGBM model correctly predicted 744 non-MVN (benign) attacks and only 4 attacks, including false injection, Sybil, blackhole, and DoS.

Figure 16. Confusion matrix of LightGBM model.

In Table 5, we show the classification report for the LightGBM model of our proposed ML method. In this situation, LightGBM achieves high precision (100% and 98%) and high recall (99%) for both classes, indicating it did not miss many instances of either MVN attack or benign cases.

Table 5. LightGBM classification report.

		Precision	Recall	F1-Score	Support
	0	1.00	0.99	1.00	748
	1	0.98	0.99	0.99	252
accuracy				0.99	1000
macro	avg	0.99	0.99	0.99	1000
weighted	avg	0.99	0.99	0.99	1000

4.8. Result Analysis Comparison of the Proposed Method and Standard Methods

Discussion of Results

In Table 6, we compare our proposed ML method, which includes the RF, XGBoost, and LightGBM models, with the standard method [3,12,25], comprising RF and Logistic Regression models, which we optimized in our proposed ML method. These models were compared with the standard models [3,12,25] for their ability to classify Benign, DoS, and MVN attacks, as well as their trustworthiness. In our proposed machine learning (ML) method, we achieve classification reports of 99% and precision, recall, and F1 Scores of 99% for both DoS attack and benign classes. In addition, we established a trustworthiness score of 100%. Whilst the standard models, such as [3,12,25], achieved precision, recall, and F1-score of 98% each, respectively, they lacked trustworthiness. This suggests that our proposed ensemble ML methods outperform the other standard models [3,12,25].

Table 6. Comparisons of our proposed ML method and the Standard techniques [3,12].

ML Model	Class	Precision%	Recall%	F1-Score%
[3,12,25] (Random Forest + Logistic regression)	Benign	98%	98%	98%
	Dos, and other MVN attacks	98%	98%	98%
	Trust	Not applicable (NA)	NA	NA
Proposed (Random Forest + XGBoost + LightGBM)	Benign	100	99%	99%
	DoS	98%	99%	99%
	Trust	99%	99%	99%

Based on Table 7, we compare our proposed ML method, which includes the RF, XGBoost, and LightGBM models, with other state-of-the-art standard method models such as [3,12,13,25], which comprise RF and logistic regression. However, we based our proposed ML framework design on RF and logistic regression, as well as on other traditional 5G-enabled VANET methods that did not use ML or any classification models. These traditional VANET models did not report metrics such as accuracy and confusion matrices; instead, they reported the performance metrics of their proposed models. However, we optimized these 5G-enabled VANET traditional models using our proposed ML method to improve performance and achieve higher accuracy. We also developed a confusion matrix to confirm the excellent performance of our ML method models. These models were compared with our proposed ML method models for their ability to accurately classify Benign, DoS, and MVN attack categories in the dataset, as well as their trustworthiness. In our proposed machine learning (ML) method, we achieve 99% accuracy in classifying MVN and predicting both attack categories and benign classes. We used precision, recall, and F1-score of 100% each, and established a trustworthiness score of 100%. Meanwhile, the standard models, such as [3,12,25], achieved an accuracy of only 95%, with precision, recall, and F1-score of 98%, respectively, without a confusion matrix to confirm the model’s excellent performance. This presupposes that our proposed RF and ensemble model’s optimization outperforms the existing literature, such as the VANET method [3,12,25]. These literature methods do not investigate trust or employ ensemble ML models; instead, they rely on a traditional 5G-enabled model with security and privacy limitations.

Table 7. Comparisons of our proposed ML method’s accuracy and the standard techniques [3,12,13,14].

Research	ML Models	Year of Research	Accuracy	Confusion Matrix
[12]	Random Forest + Logistic regression	2025	95%	NA
[3]	Traditional model	2022	NA	NA
[13]	Traditional model	2023	NA	NA
[25]	Random Forest	2023	NA	NA
Proposed Method	Proposed (RandomForest + XGBoost + LightGBM)	2026	99%	Applicable

5. Conclusions

Due to the proliferation of 5G-enabled VANET malicious node attacks, security and trustworthiness have become significant concerns for the efficient delivery of information to drivers and vehicles using Intelligent Transportation Systems (ITS). Trust and privacy information-sharing limitations result in inefficient information dissemination for drivers. This concern may result in significant casualties in Intelligent Transportation Systems (ITS). In this research, we used machine learning (ML) methods, including Random Forest, XGBoost, and LightGBM models and classifiers, to investigate and classify the efficient malicious vehicular node (MVN) attack features, such as false data injection attacks, Sybil attacks, Black hole attacks, and denial-of-service (DoS) attacks, in a 5G-enabled VANET dataset. Our proposed ML method, which leverages trust relationships across all vehicles in our framework, ensures security, privacy, and trustworthiness. The proposed machine learning models, such as Random Forest, XGBoost, and LightGBM models, in our method are used to classify the malicious vehicular node (MVN) features and clearly affirm that the trust scores are essential features. Compared with traditional 5G-enabled VANET methods, the use of machine learning (ML) and trust provision in 5G-enabled VANETs was a significant limitation, making it urgent to investigate this issue in this context.

Traditional VANET and other ML models were compared with our proposed ML method models for their ability to accurately classify Benign, DoS, and MVN attacks, as well as their trustworthiness. In our proposed machine learning (ML) method, we achieve 99% accuracy in classifying MVN attack categories and predicting both attack and benign classes, with precision, recall, and F1-score of 99% each, and establish a trustworthiness score of 100%. Whilst the standard models, such as [3,12], which involve a blend of traditional and ML, achieved an accuracy of only 95%, with precision, recall, and F1-score of 99%, respectively, without using a confusion matrix to confirm the model’s performance. This suggests that our proposed ensemble ML methods outperform the other standard models [3,12,25]. It also outperforms other traditional methods, such as [3,13].

For future work, we plan to use deep learning models and frameworks, including Liquid Neural Networks (LNNs), to detect malicious vehicular node attacks in a 5G-enabled VANET dataset, in real time and in a lightweight manner. We also plan to test our proposed models on a large public dataset to ensure they do not overfit.